diff --git a/extensions/google/package.json b/extensions/google/package.json
index 7750fe3f3363..da30f1de6b32 100644
--- a/extensions/google/package.json
+++ b/extensions/google/package.json
@@ -6,7 +6,7 @@
   "type": "module",
   "dependencies": {
     "@google/genai": "2.23.0",
-    "dotenv": "18.0.1",
+    "dotenv": "18.0.3",
     "google-auth-library": "11.1.0"
   },
   "devDependencies": {
diff --git a/extensions/migrate-hermes/package.json b/extensions/migrate-hermes/package.json
index 9e02424cb6f9..fe15d4402d00 100644
--- a/extensions/migrate-hermes/package.json
+++ b/extensions/migrate-hermes/package.json
@@ -5,7 +5,7 @@
   "description": "Hermes to OpenClaw migration provider",
   "type": "module",
   "dependencies": {
-    "dotenv": "18.0.1",
+    "dotenv": "18.0.3",
     "yaml": "2.9.1"
   },
   "devDependencies": {
diff --git a/package.json b/package.json
index b1c783d2932e..c710faacaf37 100644
--- a/package.json
+++ b/package.json
@@ -2275,7 +2275,7 @@
     "commander": "15.0.0",
     "croner": "10.0.1",
     "diff": "9.0.0",
-    "dotenv": "18.0.1",
+    "dotenv": "18.0.3",
     "entities": "8.1.0",
     "esbuild": "0.28.2",
     "execa": "10.0.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7a0a9f4a4d16..5f93aa016238 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -309,8 +309,8 @@ importers:
         specifier: 9.0.0
         version: 9.0.0
       dotenv:
-        specifier: 18.0.1
-        version: 18.0.1
+        specifier: 18.0.3
+        version: 18.0.3
       entities:
         specifier: 8.1.0
         version: 8.1.0
@@ -1306,8 +1306,8 @@ importers:
         specifier: 2.23.0
         version: 2.23.0(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.6.5))(supports-color@10.2.2)
       dotenv:
-        specifier: 18.0.1
-        version: 18.0.1
+        specifier: 18.0.3
+        version: 18.0.3
       google-auth-library:
         specifier: 11.1.0
         version: 11.1.0(supports-color@10.2.2)
@@ -1702,8 +1702,8 @@ importers:
   extensions/migrate-hermes:
     dependencies:
       dotenv:
-        specifier: 18.0.1
-        version: 18.0.1
+        specifier: 18.0.3
+        version: 18.0.3
       yaml:
         specifier: 2.9.1
         version: 2.9.1
@@ -7176,8 +7176,8 @@ packages:
     resolution: {integrity: sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==}
     engines: {node: '>=20.19.0'}
 
-  dotenv@18.0.1:
-    resolution: {integrity: sha512-0eR4m4D/jH5eaI3evo2ZqqMii5mrTCR12v12VChdie6O1gPHs7XAjzTep0CWc1Bd+oNx3vVfbi734dK4zghigw==}
+  dotenv@18.0.3:
+    resolution: {integrity: sha512-/8CJTyL817qPnfbQrJgOEcrU3fDrJkRIoXBE566wHuvIXKOCHUZhPqGPbCPi9SogjdGnreF0TlvnTgK6J/8zpA==}
     engines: {node: '>=12'}
     hasBin: true
 
@@ -14771,7 +14771,7 @@ snapshots:
       domelementtype: 3.0.0
       domhandler: 6.0.1
 
-  dotenv@18.0.1: {}
+  dotenv@18.0.3: {}
 
   dts-resolver@3.0.0: {}